Today, almost all critical business records are generated, managed and stored electronically, creating efficiencies and cost-savings for businesses. Unfortunately, digital information can be easily deleted, altered and/or manipulated. For businesses, the burden of proof is on the company to ensure and attest to the accuracy and credibility of their electronic business records. This ability to prove the integrity of critical business records becomes especially important in litigation where executives are often called upon to support their claims of ownership of any discoverable records, as well as verify their history of creation and use.
It is important to remark the difference between involuntary changes on data (like those due to errors in transmission) and voluntary changes (tampering). When the objective is to detect involuntary changes, the integrity information is commonly calculated without any kind of security added because there is not an attacker that is also going to alter the integrity to hide the data changes. Examples of patents about verification of data integrity for involuntary changes are European Patent EP1665611 “Data transmission path comprising an apparatus for verifying data integrity”, U.S. Pat. No. 5,581,790 “Data feeder control system for performing data integrity check while transferring predetermined number of blocks with variable bytes through a selected one of many channels”, U.S. Pat. No. 7,330,998 “Data integrity verification”, U.S. Pat. No. 6,446,087 “System for maintaining the integrity of application data”, European Patent EP676068 (corresponding to U.S. Pat. No. 5,694,400) “Data integrity check in buffered data transmission” and European Patent EP1198891 “Data integrity management for data storage systems” amongst others.
But when the objective is to detect tampering, the method used to provide data integrity needs to prevent as well the tampering on the integrity information, therefore some kind of cryptography is required. The invention proposed fits in this category.
In well regulated environments that operate with large volumes of sensitive information it is needed to guarantee the integrity of data with a system that eliminates the risk of data manipulation.
Electronic records have been proven to have been manipulated in cases ranging from stock options fraud to loan fraud to intellectual property disputes.
Some recent examples of actual cases surrounding the manipulation of electronic records include:
Top executives at a successful technology company attempted to alter electronic records to hide a secret options-related slush fund to cover the tracks of their backdating options scheme.
A prominent real estate developer received an electronic version of a loan agreement to print and sign. Rather than just signing the document, he made subtle changes to it in order to make the terms of the loan more favorable to himself. The changes went undetected for a year until the loan was refinanced.
An auditor impeded a federal investigation by intentionally altering, destroying and falsifying the financial records of a now defunct credit card issuer in order to downplay or eliminate evidence that there were “red flags” that he should have caught.
Two major Wall Street firms settled with the SEC after being accused of “late trading”. Late trading or “after-hours” trading involves placing orders for mutual fund shares after the market close, but still getting that day's earlier price, rather than the next day's closing price.
A prominent scientist, funded by millions of dollars in state and private funding was charged with fraud and embezzlement, after admitting that he manipulated photo images of stem cells in his research.
The industry has been addressing these deficiencies by several means, including the use of WORMs (Write Once Read Many) devices, the use of digital signatures, redundant off-site storage managed by different people, etc., but all of them have aspects to demand a more efficient solution: WORMs are slower than any other storage device and one risk is that a drive can be replaced by another one tampered; digital signatures have a high computational cost that makes impossible to use standalone in systems with significant transaction volume and do not prevent the change of order; and duplicating the storage systems and administration have cost issues and difficult the further audit process.
Most solutions are based today in the use of digital signatures (Public Key Infrastructure based) accompanied by an accurate date and time stamp to provide authenticity to the data susceptible of further audit but the following issues are not addressed:
When processing a huge volume of data, the performance required is not cost efficient or even it is directly not possible to implement because lack of performance of digital signatures.
Digital signatures and timestamps do not provide by themselves the guarantee that there have not been entries deleted without notice, which in fact means immutability is not a feature of such log registries.
There is a patent that proposes a primitive solution by using a cumulative hash function (U.S. Pat. No. 6,640,294) but it does not address the problem of malicious tampering because it is possible to recalculate the entire set of hashes to match the modified data values (it is clear when saying “[ . . . ] if there is an accidental error, attempts to recover the lost data can be made [ . . . ]” at column 3 line 32). U.S. Pat. No. 6,640,294 is also oriented to data storage.
For applications where integrity granularity is valuable, there are several recent alternatives to digital signatures based on immutable digital chains, i.e. the combination of hash chains and asymmetric cryptography (including digital signature). See for instance WO 2008/010006 A1 for a method for immutable digital chains. In that same publication there are references to prior art also using other forms of immutable digital chains.